CVE-2023-27602: Apache Linkis Unrestricted File Upload vulnerability
Summary
CVE-2023-27602: Apache Linkis Unrestricted File Upload vulnerability. Affects org.apache.linkis:linkis versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is an open-source project that provides a unified big data platform for data processing and analysis. It allows users to submit and manage their jobs on distributed computing frameworks. The vulnerability in Apache Linkis <=1.3.1 allows for unrestricted file uploads, without any restrictions on the path or file types. This can lead to potential security risks and unauthorized access to sensitive files.
Vulnerability Detail
The PublicService module in Apache Linkis <=1.3.1 does not enforce any restrictions on the path or file types during file uploads. This means that an attacker can upload malicious files to arbitrary locations within the system, potentially leading to remote code execution, data leakage, or other security breaches. The lack of proper file path and type validation poses a critical security risk to the affected versions of Apache Linkis.
How To Fix
Latest published version: 1.8.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For versions <=1.3.1, a temporary workaround is to enable the file path check switch in the linkis.properties file. This can be done by setting the following properties:
wds.linkis.workspace.filesystem.owner.check=true wds.linkis.workspace.filesystem.path.check=true
Enabling these properties will enforce file path and ownership checks during file uploads, reducing the risk of unauthorized access and potential security breaches.
Conclusion
The Apache Linkis Unrestricted File Upload vulnerability in versions <=1.3.1 poses a critical security risk, allowing for unauthorized file uploads and potential security breaches. It is highly recommended to upgrade to version 1.3.2 or apply the provided workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.linkis:linkis →
FAQ
Apache Linkis is an open-source project that provides a unified big data platform for data processing and analysis. It allows users to submit and manage their jobs on distributed computing frameworks.
The unrestricted file upload vulnerability in Apache Linkis <=1.3.1 can lead to potential security risks and unauthorized access to sensitive files. Attackers can upload malicious files to arbitrary locations within the system, potentially leading to remote code execution, data leakage, or other security breaches.
To fix this vulnerability, it is recommended to upgrade to version 1.3.2 of Apache Linkis. This version includes the necessary fixes and enhancements to enforce proper file path and type validation during file uploads.
For versions <=1.3.1, a temporary workaround is to enable the file path check switch in the linkis.properties file. This can be done by setting the 'wds.linkis.workspace.filesystem.owner.check' and 'wds.linkis.workspace.filesystem.path.check' properties to 'true'. Enabling these properties will enforce file path and ownership checks during file uploads, reducing the risk of unauthorized access and potential security breaches.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-x84r-jrqm-3hj8/GHSA-x84r-jrqm-3hj8.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.linkis:linkis.
